Modeling and design of secure software systems

较差的软件系统安全性（易受入侵的形式）可能允许未经授权的接管这些系统的关键功能，导致从银行欺诈到恐怖主义活动的各种事件。由于安全缺陷的后期修复往往更加耗时和昂贵，因此拥有更快的建模技术非常重要，它将帮助设计人员在设计周期的早期快速、轻松地分析设计。所有的设计都涉及权衡，如果我们仅仅针对安全性属性进行优化，我们就有可能忽略其他重要的属性，例如性能和可靠性，这些属性都受到安全性解决方案的影响。我建议的研究是开发建模技术和工具，这些技术和工具将有助于以统一的方式分析多个属性——性能、可靠性和安全性，并有助于更好地理解设计权衡。该提案的主要特征包括：(i)开发用于软件系统安全性概率验证的新型建模技术，（ii）集成模型来分析性能，可靠性和安全性，（iii）在可靠和安全软件工程方面培训研究生。该研究将采用随机模型来表示系统行为。

Poor security of software systems (in form of high vulnerability to intrusions) may allow unauthorized takeover of the critical functionalities of those systems, leading to events ranging from bank fraud to terrorist activities. Since late fixing of security flaws tends to be more time consuming and expensive, it is important to have faster modeling techniques that would assist designers to analyze designs quickly and easily, early in the design cycle. All designs involve tradeoffs and if we simply optimize for the security attribute, we stand the chance of ignoring other attributes of importance, for example performance and dependability, which are affected by security solutions. My proposed research is concerned with developing modeling techniques and tools that would help in analyzing multiple attributes - performance, dependability and security - in a unified way, and would aid in better understanding of design tradeoffs. Key features of this proposal include: (i) development of novel modeling techniques for probabilistic validation of security of software systems, (ii) integrated models to analyze performance, dependability and security, (iii) training of research students in the engineering of dependable and secure software. The research will employ stochastic models for representing system behavior.